Version 1.6 · Last updated 25 September 2026
This document is the Security Policy of Capradix LLC ("Capradix") referenced in the Capradix Cloud Service Agreement and Data Processing Agreement, and describes the technical and organizational measures Capradix applies to the data it processes on behalf of its customers. It is incorporated by reference into those agreements and into the Capradix Terms of Service and Privacy Policy.
Capradix processes the records a customer organization maintains concerning its own investors and portfolio, including names, contact information, taxpayer identification numbers, dates of birth, demographic information where the customer elects to record it, and the financing, contribution, and distribution records that constitute the customer's books.
2.1 At rest. The following categories of personal data are encrypted at the application layer, before being written to the database, using non-deterministic AES encryption with keys maintained outside the database:
City, state and country are stored unencrypted to permit regional reporting. Sign-in email addresses are stored unencrypted because authentication requires that they be queried. Passwords are stored solely as bcrypt digests and are not recoverable. The database is additionally encrypted at rest by the hosting provider.
2.2 In transit. All connections to the Service are encrypted using HTTPS, enforced at the server.
3.1 Roles. The Service provides two roles. Administrators may access the records of their own organization. Investors may access only their own investor record, their own tax entities, and the companies in which their investor has invested, and may not access the positions of any other investor or any carried-interest detail.
3.2 Tenant isolation. Every record carries an organization identifier. A request by one organization for a record belonging to another returns a "not found" response indistinguishable from that returned for a nonexistent record. Both the role restrictions and the tenant isolation are enforced in the application and verified by automated tests executed on every change to the software.
3.3 Authentication. Sign-in requires a password and, as a second step, a six-digit code sent to the user's email address, valid for ten minutes and for five attempts. The second step is required for every administrator and may be required of investors by their organization; investors may otherwise enable it themselves. A user may trust a browser for thirty (30) days, and may revoke that trust at any time. Sign-in, code entry and password-reset requests are rate limited.
3.4 Change history. Every change to or deletion of a customer record is recorded with the field, the previous and new values, the user who made it, the time, and the reason where one was given. Encrypted values are recorded only as changed, never in clear text. The history is shown to administrators on the record's page and cannot be edited or removed through the Service.
Race and ethnicity are processed only where a customer elects to record them, for the diversity reporting that venture groups perform with respect to their membership and the founders they support. Such data is encrypted at rest in accordance with Section 2, is not used for automated decision-making or profiling, and is presented only on the administrators' investor roster, in columns hidden by default, and in the customer's own exports.
Capradix engages the following sub-processors in the provision of the Service:
| Provider | Purpose | Location |
|---|---|---|
| Render | Application hosting and database | Oregon, United States |
| Resend | Transactional email: invitations, password resets, notifications an investor has enabled, and messages a Customer's administrators write to the investors in a portfolio company, fund or SPV; and, where a Customer enables automatic portfolio updates, receiving the emails sent to its update address and sending the Customer's update reminders to its portfolio companies | United States |
| Sentry | Error monitoring, configured to exclude personal data | United States (Iowa) |
| Cloudflare | Storage of documents uploaded by administrators (R2), and DNS | United States |
| Anthropic | Reading documents an administrator submits, and portfolio update emails where a Customer has enabled automatic portfolio updates: receives the document's full contents and returns the facts found. Not used to train models; retained by Anthropic for up to thirty days to detect misuse, then deleted | United States |
All customer personal data is stored in the United States. The authenticated portion of the Service contains no analytics services, tag managers, or third-party scripts. Customers receive advance notice of any addition or replacement of a sub-processor in accordance with the Data Processing Agreement.
Suspected security vulnerabilities and incidents may be reported to security@capradix.com. Capradix will notify affected customers of a confirmed security incident without undue delay, and in any event within seventy-two (72) hours of becoming aware of it, as provided in the Data Processing Agreement.
A customer may export every fact it has entered, in CSV format, at any time and without the involvement of Capradix. Upon termination, customer data remains available for export for thirty (30) days and is deleted within sixty (60) days of the customer's request. The database is backed up continuously with point-in-time recovery, supplemented by retained periodic archives.
Capradix does not currently undergo third-party security audits and holds no SOC 2 or ISO certification. Security due diligence is conducted by questionnaire under Section 5.3 of the Data Processing Agreement. This Policy will be revised if that changes.
Security inquiries and due diligence requests may be directed to security@capradix.com. General inquiries may be directed to hello@capradix.com.